CVE-2026-82753 ash-project CVE debrief

Who should care

Defenders responsible for ash_authentication_oauth2_server deployments, particularly those using version 0.3.0, should assess exposure and potential impact. Defenders should prioritize verifying exposure and assessing potential impact due to the Allocation of Resources Without Limits or Throttling vulnerability in ash_authentication_oauth2_server. Those managing ash_authentication_oauth2_server should review compensating controls for exposed systems while

Why it matters

CVE-2026-82753 is an Allocation of Resources Without Limits or Throttling vulnerability in ash_authentication_oauth2_server that allows an unauthenticated attacker to cause potential database storage and memory exhaustion. Defenders should prioritize verifying exposure, assessing potential impact, and implementing compensating controls.

• Potential for database storage exhaustion
• Potential for memory exhaustion
• Need for verification of affected versions and exposure
• Priority for upgrading to version 0.3.1 or later

Technical summary

The /authorize endpoint in ash_authentication_oauth2_server is unauthenticated by design. With Client ID Metadata Documents enabled, an attacker can create permanent client rows with multi-megabyte strings, leading to unbounded growth of storage and memory. This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1. The vulnerability allows an unauthenticated attacker to exhaust database storage and memory by creating permanent client rows with multi-megabyte strings through the /authorize endpoint.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact due to the Allocation of Resources Without Limits or Throttling vulnerability in ash_authentication_oauth2_server.

Recommended defensive actions

• Verify if ash_authentication_oauth2_server versions 0.3.0 are in use and assess exposure
• Implement compensating controls to limit the number of client rows and enforce length bounds on fetched fields
• Monitor database storage and memory usage for abnormal growth
• Consider upgrading to version 0.3.1 or later
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability allows an unauthenticated attacker to exhaust database storage and memory by creating permanent client rows with multi-megabyte strings through the /authorize endpoint. With Client ID Metadata Documents enabled, an attacker can create permanent client rows with multi-megabyte strings, leading to unbounded growth of storage and memory. The /authorize endpoint is unauthenticated by design. Client ID Metadata Documents enabled resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.